Ntdebugging Blog

Microsoft Advanced Windows Debugging and Troubleshooting - Contributions to this blog are made by the Microsoft Global Business Support - Windows Serviceability team.

Virtual Machine Managment Hangs on Windows Server 2012 R2 Hyper-V Host

Hi, my name is Christian Sträßner from the Global Escalation Services team based in Munich, Germany....

Author: ntdebug Date: 01/22/2016

When Special Pool is not so Special

Hi Everyone.  Richard here in the UK GES team bringing you an interesting case we saw recently...

Author: ntdebug Date: 11/04/2015

We Are Hiring – North Carolina and Texas

Would you like to join the world’s best and most elite debuggers to enable the success of Microsoft...

Author: ntdebug Date: 10/16/2015

Uncover the mystery of a bugcheck 0x24 (NTFS_FILE_SYSTEM)

  My name is Nan, I am an Escalation Engineer in Platforms Global Escalation Services in GCR....

Author: ntdebug Date: 04/30/2015

We Are Hiring Windows Escalation Engineers in Munich, Germany

Would you like to join the world’s best and most elite debuggers to enable the success of Microsoft...

Author: ntdebug Date: 01/15/2015

Disk Performance Internals

Abstract: My name is Ran Jiang. I am from the Platforms Global Escalation Services team in China....

Author: ntdebug Date: 12/09/2014

Driver Object Corruption Triggers Bugcheck 109

My name is Victor Mei, I am an Escalation Engineer in Platforms Global Escalation Services in...

Author: ntdebug Date: 11/20/2014

How to identify a driver that calls a Windows API leading to a pool leak on behalf of NT Kernel?

Hello my name is Gurpreet Singh Jutla and I would like to share information on how we can trace the...

Author: ntdebug Date: 09/12/2014

Windows Troubleshooting – Stop 9E Explained

What to do if a stop 9E occurs.  How you can solve the issue yourself.

Author: ntdebug Date: 08/27/2014

Windows Troubleshooting – Special Pool

The Windows Support team has a new YouTube channel, “Windows Troubleshooting”.  The first set...

Author: ntdebug Date: 08/27/2014

Bugchecking a Computer on A Usermode Application Crash

Hello my name is Gurpreet Singh Jutla and I would like to share information on how we can bugcheck a...

Author: ntdebug Date: 06/19/2014

Understanding ARM Assembly Part 3

My name is Marion Cole, and I am a Sr. Escalation Engineer in Microsoft Platforms Serviceability...

Author: ntdebug Date: 05/29/2014

Debugging a Windows 8.1 Store App Crash Dump (Part 2)

In Part 1, we covered the debugging of a Windows Store Application crash dump that contains a Stowed...

Author: ntdebug Date: 05/28/2014

Understanding ARM Assembly Part 2

My name is Marion Cole, and I am a Sr. Escalation Engineer in Microsoft Platforms Serviceability...

Author: ntdebug Date: 05/15/2014

NTFS Misreports Free Space (Part 3)

It’s been a while since my last post on this topic, and I wanted to take some time to update...

Author: ntdebug Date: 05/08/2014

Debugging a Windows 8.1 Store App Crash Dump

Quality reports on the App Summary page Microsoft provides triage dumps of your Windows Store...

Author: ntdebug Date: 01/13/2014

Understanding Pool Corruption Part 3 – Special Pool for Double Frees

In Part 1 and Part 2 of this series we discussed pool corruption and how special pool can be used to...

Author: ntdebug Date: 12/31/2013

Event ID 157 "Disk # has been surprise removed"

Hello my name is Bob Golding and I would like to share information on a new error you may see in the...

Author: ntdebug Date: 12/27/2013

Understanding ARM Assembly Part 1

My name is Marion Cole, and I am a Sr. EE in Microsoft Platforms Serviceability group.  You may...

Author: ntdebug Date: 11/22/2013

The Compiler Did What?

I was recently investigating a crash in an application.  As I researched the issue I found a...

Author: ntdebug Date: 11/07/2013

Great power. Great responsibility.

When it comes to the registry, administrators are given great power to manually configure Windows to...

Author: ntdebug Date: 10/29/2013

Debugging a Generation 2 Virtual Machine

Hyper-V is based on the 440BX (PCI) chipset for emulation. The decision to use this chipset started...

Author: ntdebug Date: 10/24/2013

Performance Monitor Averages, the Right Way and the Wrong Way

Performance Monitor (perfmon) is the preferred tool to measure the performance of Windows...

Author: ntdebug Date: 09/30/2013

ResAvail Pages and Working Sets

Hello everyone, I'm Ray and I'm here to talk a bit about a dump I recently looked at and a...

Author: ntdebug Date: 09/04/2013

Missing System Writer Case Explained

I worked on a case the other day where all I had was a procmon log and event logs to troubleshoot a...

Author: ntdebug Date: 08/27/2013

Understanding Pool Corruption Part 2 – Special Pool for Buffer Overruns

In our previous article we discussed pool corruption that occurs when a driver writes too much data...

Author: ntdebug Date: 08/22/2013

Understanding Pool Corruption Part 1 – Buffer Overflows

Before we can discuss pool corruption we must understand what pool is.  Pool is kernel mode...

Author: ntdebug Date: 06/14/2013

Another Who Done It

Hi my name is Bob Golding, I am an EE in GES. I want to share an interesting problem I recently...

Author: ntdebug Date: 05/31/2013

Remoting Your Debug Crash Cart With KDNET

This is Christian Sträßner from the Global Escalation Services team based in Munich, Germany.  ...

Author: ntdebug Date: 05/09/2013

Our Bangalore Team is Hiring - Windows Server Escalation Engineer

Would you like to join the world’s best and most elite debuggers to enable the success of Microsoft...

Author: ntdebug Date: 05/09/2013

Interpreting Event 153 Errors

Hello my name is Bob Golding and I would like to share with you a new event that you may see in the...

Author: ntdebug Date: 04/30/2013

Commitment Failures, Not Just a Failed Love Story

I was working on a debug the other day when I ran the “!vm” command and saw that the system had some...

Author: ntdebug Date: 04/16/2013

Debugging a Network Connectivity Issue - TrackNblOwner to the Rescue

Hello Debug community this is Karim Elsaid again.  Today I’m going to discuss a recent...

Author: ntdebug Date: 03/29/2013

Understanding File System Minifilter and Legacy Filter Load Order

Hello, my name is Fred Jeng from the Global Escalation Services team. For today’s post, I want to go...

Author: ntdebug Date: 03/25/2013

Don't Believe Everything You Read

Recently, I was contacted by a customer who was advised by an ISV to set a registry value under one...

Author: ntdebug Date: 03/06/2013

Leaving the Do Not Disturb Sign on the Door Will Cause the KERNEL_APC_PENDING_DURING_EXIT Bugcheck

This is Ron Stock from the Global Escalation Services team and I recently worked with a customer to...

Author: ntdebug Date: 02/28/2013

Debugging a Debugger to Debug a Dump

Recently I came across an instance where my debugger did not do what I wanted.  Rarely do...

Author: ntdebug Date: 02/27/2013

How to Setup a Debug Crash Cart to Prevent Your Server from Flat Lining

This is Ron Stock from the Global Escalation Services team and I recently had the task of live...

Author: ntdebug Date: 01/31/2013

Case of the Unexplained Services exe Termination

Hello Debuggers! This is Ron Stock from the Global Escalation Services team and I recently worked an...

Author: ntdebug Date: 01/30/2013

Use Caution When Implementing IPC for Performance Counters

  Recently I was working with a developer who had created performance counters that work in...

Author: ntdebug Date: 12/31/2012

Determining the source of Bug Check 0x133 (DPC_WATCHDOG_VIOLATION) errors on Windows Server 2012

What is a bug check 0x133? Starting in Windows Server 2012, a DPC watchdog timer is enabled which...

Author: ntdebug Date: 12/07/2012

Troubleshooting Pool Leaks Part 7 – Windows Performance Toolkit

In Part 1 of this series we identified a pool leak in non paged pool.  In Part 2 and Part 3 of...

Author: ntdebug Date: 11/30/2012

Troubleshooting Pool Leaks Part 6 – Driver Verifier

In part 5 we used poolhittag to get call stacks of pool being allocated and freed.  This...

Author: ntdebug Date: 10/31/2012

Breaking down the "Cl" in !irp

Hey there NTDEBUGGERS my name is Randy Monteleone and today we are going to talk about IRPs. In the...

Author: ntdebug Date: 10/29/2012

Troubleshooting Pool Leaks Part 5 – PoolHitTag

In Part 4 we narrowed the source of the leaked pool memory to the specific driver which is...

Author: ntdebug Date: 09/28/2012

Troubleshooting Pool Leaks Part 4 – Debugging Multiple Users for a Tag

In our previous articles we discussed various techniques for identifying a pool memory leak and...

Author: ntdebug Date: 09/28/2012

Troubleshooting Pool Leaks Part 3 – Debugging

In our previous articles we discussed identifying a pool leak with perfmon, and narrowing the source...

Author: ntdebug Date: 08/31/2012

Troubleshooting Pool Leaks Part 2 – Poolmon

In our previous article we discussed how to identify a pool leak using perfmon.  Although it...

Author: ntdebug Date: 08/30/2012

Troubleshooting Pool Leaks Part 1 – Perfmon

Over the years the NTDebugging Blog has published several articles about pool memory and pool...

Author: ntdebug Date: 07/31/2012

How To Deadlock Yourself (Don’t Do This)

Some APIs should come with a warning in big red letters saying “DANGER!”, or perhaps more subtly...

Author: ntdebug Date: 07/19/2012

Next>